Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having networking problems on a virtual Debian server. The VPS provider I think may be the cause of these network problems as it's a fairly new/fairly standard Debian install. However, as their technical support is useless, I'm trying to determine the cause of the network problems partially to prove that it isn't my mis-configuration and partially so I can direct their technical support vaguely in the right direction so I don't keep getting e-mails back telling me "it looks fine to us".

I actually have 2 virtual servers with this host. One is fine, the other frequently requires me to reboot the network otherwise I can't get any external connections (either in or out) and internal connections are dog slow.

I ran a tcpdump on the problem machine showing everything except my own ssh traffic, and the majority of the return was this, repeated over and over:

09:49:43.328322 ARP, Request who-has tell, length 42 09:49:43.365528 ARP, Request who-has tell, length 46 09:49:43.365662 ARP, Request who-has tell, length 46 09:49:43.365760 ARP, Request who-has tell, length 46 09:49:43.450859 ARP, Request who-has tell, length 46 09:49:43.711473 ARP, Request who-has tell, length 46 09:49:43.761538 ARP, Request who-has tell, length 46 09:49:43.806078 ARP, Request who-has tell, length 46 09:49:43.929437 ARP, Request who-has tell, length 46 09:49:44.122110 ARP, Request who-has tell, length 46 09:49:44.148619 ARP, Request who-has tell, length 46 09:49:44.203619 ARP, Request who-has tell, length 46 09:49:44.263640 ARP, Request who-has tell, length 46 09:49:44.296925 ARP, Request who-has tell, length 46

I ran a tcpdump on the other machine (the one that seems fine) and got back the same result. So perhaps this isn't the cause? If the other one is seemingly fine. Although I'm pretty sure having a constant stream of ARP requests isn't healthy?

If anyone can please tell me more on what these ARP requests are and whether they're likely to be causing problems - also anything else I should check to try and diagnose the problem further.


share|improve this question
It might be worthwhile timing your network outages just so you can see if there is a regular pattern to them. A simple script with a ping to the outside world, along with the time, should do the trick. – blankabout Apr 19 '11 at 9:43
up vote 2 down vote accepted

This is pretty normal for an Ethernet network and most likely a red herring. is most likely checking if hosts are still connected to the network. this can be done for many reasons, such as clearing up space in the DHCP lease database, check for IP conflicts, network monitoring and such. A few ARP a second is not a problem. If you are dealing with a proper ARP flood you will typically see 10k+ ARP packets a second.

So you will probably have to look elsewhere for the source of your network problem.

share|improve this answer
Thanks. Do you have any suggestions for things I could check? – Matt McDonald Apr 19 '11 at 9:35
I would start by looking for address conflicts, as that is the most common source of weird networking problems. I would also check the logs, especially dmesg for any hints of what it could be. – pehrs Apr 19 '11 at 10:03
I noticed that the machine without problems had the internal IP's gateway hashed out in the network config. I've done the same to the problem machine, and it's been OK for the past few hours. Fingers crossed that was it! – Matt McDonald Apr 19 '11 at 15:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.